SECURITY AUDIT REGISTRY

Precision loss in 18-decimal reward accrual causes USDC staking rewards to round to zero — stakers receive nothing despite the distribution being funded.

Liquidations revert because feeRecipient is never initialized; and the withdraw path under-repays debt for token1-borrowed positions.

Deferred operator-fee collection gives users who withdraw earlier a better share price than later ones; a broken onlyOperator check also locks out approved operators.

setMintRate changes the mint rate without settling the reward index, so a rate change retroactively re-prices rewards already earned under the old rate.

Twelve findings across the token, lending and treasury layers — including two index-scaling bugs that over-mint rToken balances and over-state user debt.

Anyone can sweep the sponsor bonus to the recovery address before a moderator corrects a mistaken outcome, so a later-named whitehat is paid only the stake, not the bonus.

Finding details are under NDA — the contest report is private.

Two accepted insights on the pool mechanics — gas-optimization patterns for the high-frequency game and liquidity interactions.

Three accepted insights across the FAssets collateral and minting flow.